Varnish Artifact Firewall in the time of Black October

A malicious LiteLLM release was live on PyPI for 1 hour and 43 minutes. What October's attacks teach, the control that would have kept it out of your builds, and five things to do this week.

"Black October" has been in every security channel since October 22nd. It is the name that's been given to a month of major breaches and disclosures, where AI has been both the tool and the target. If you run a platform or security team, you have probably spent the week answering one question from above: are we exposed?

We built Varnish Artifact Firewall to protect the software supply chain, so this has been a busy month for us. Here is what we think teams should take from it.

The LiteLLM attack

A central part of Black October was the attack on LiteLLM, a Python library with about 23 million weekly downloads on PyPI. It is also the clearest lesson of the month: it shows how fast a poisoned release travels, and how simple the defence can be.

1 hour and 43 minutes

The malicious LiteLLM release went live on PyPI at 11:39 UTC. A scanner flagged it about seven minutes later. PyPI pulled it at 13:23 (LiteLLM's incident report). In that window it was downloaded about 49,000 times.

Detection was fast. Distribution was faster. That is normal behaviour: 50% of organisations adopt a new library version within 24 hours of release.

Waiting is the control

The simplest defence against a hijacked release is to not install it on day one. A minimum release age, also called a cooldown or quarantine, holds new versions back for a day or two while the ecosystem catches problems. It works even when nobody has detected anything yet. This is now mainstream. CISA recommended a seven-day wait for npm after the axios compromise in April, and this month both GitHub and GitLab launched package firewalls of their own. The hard part is enforcing it across organizations. A rule on a wiki page does not stop a build server somewhere from pulling a version published ten minutes ago.

Does waiting slow down urgent security fixes? It can, which is why the wait needs an exception path. A specific fix can be let through early, reviewed like any other change, without switching the protection off for everything else.

Five things to do this week

If you are wondering where to start, these are the five steps we would take first:

• Create one path. Send every build through a proxy or registry you control, and stop builds from fetching straight from public registries.

• Wait a day or two. Hold new versions back, with a reviewed way to let urgent fixes through.

• Install from lockfiles. Builds should never pick up "latest" by surprise.

• Log every download. "Did we pull it?" should take minutes to answer, not days.

• Rotate publishing and CI tokens. A hijacked release only needs someone who can publish as the maintainer.

Where Varnish Artifact Firewall fits

Varnish Artifact Firewall is how we make that list enforceable. It sits between your builds and the public registries, or in front of the Artifactory or Nexus you already run, and applies company policy to every developer and every build. A one-day hold would have kept LiteLLM 1.107.0 out of builds pulling new versions, with no threat intelligence needed.

In practice, teams start in report mode. Before anything is enforced, they can see exactly which new versions would have been held back and which known-bad packages would have been blocked, across npm, PyPI, Maven, NuGet, Go and more. Then they switch to enforcement, with one policy enforcement layer for every team instead of a setting on each developer’s laptop.

Not just LiteLLM

LiteLLM was the loudest software supply chain incident, but not the only one: tensorlake and @subql/common on npm followed the same pattern, and the GhostAction campaign on GitHub went after the publishing tokens that make it possible. A new version that looks legitimate, published by someone who should not be publishing it, is exactly the kind of release a hold is built for.

Learn more

Black October will fade, the story will continue: releases will get hijacked, scanners will catch them within minutes, and builds will pull them faster. A short, enforced wait closes that gap for hijacked releases.

Varnish Artifact Firewall comes with a 30-day free trial with full features. Talk to an expert, read the product overview, or go to the documentation.